AWS emphasizing database security as AI powers new threats

AWS is ready for the ways agentic AI is changing database security needs.

That's according to Eric Brandwine, a vice president and distinguished engineer for the tech giant and a longtime data security specialist.

Security is a fundamental aspect of AWS's database strategy, Brandwine told TechTarget. Rather than being an afterthought, a feature that gets bolted on after a database is developed, security is built into AWS databases such as DynamoDB, Aurora, RDS (Relational Database Service), ElastiCache, DocumentDB and Neptune.

And it's always been that way.

Agentic AI, meanwhile, is changing database security needs. Because agents can autonomously search and act on data at exponentially greater speed and scale than humans, they can find cracks in database security that humans likely would have never discovered. They can even forge new vulnerabilities that, if not caught quickly, could expose an organization's proprietary information.

In addition, because agents can operate so much faster than humans, they are enabling threat actors to automate attacks at higher volume than in the past.

In response, Oracle recently made some of its security capabilities available to customers at a significant discount. Similarly, database providers such as Microsoft and MongoDB added security capabilities specifically designed for agentic AI, while Snowflake improved its security capabilities after hackers used a former employee's password to steal customer data.

AWS is likewise ready to both defend against attacks powered by agents as well as deploy agents to defend against nefarious activity, according to Brandwine. And AWS has been seen since it first started offering database services, with agentic AI just the latest new technology to deploy and defend against.

Eventually, there will be another, and with strict access controls and identity management, encryption while data is both at rest and in motion, and virtual private clouds to isolate networks, AWS has security capabilities built into its databases that are designed to stop any threat before it causes a significant breach.

In a recent interview, Brandwine discussed AWS's database strategy, including the longstanding value it has placed on protecting enterprise data and how its security capabilities are designed to shield against even threats powered by agents and other emerging technologies.

In addition, he spoke about the benefits of sufficient database security and the costs of insufficient database security, the new features that are being added to improve AWS's database security, and how agentic AI is driving that evolution.

Editor's note: This Q&A has been edited for clarity and conciseness.

Before the rise of agentic AI over the past couple of years, what was the typical security setup for a database?

Eric Brandwine

Eric Brandwine: The database security landscape has been, and always will be, incredibly varied. At AWS, [Amazon president and CEO] Andy Jassy used to get on stage every year at re:Invent and say, 'Security is job zero.' We take that seriously. It is our goal to make AWS the most secure place for any customer to run any workload, and that extends to our database services. They have been designed, from day one, to provide a secure place for customers to place their most sensitive data.

The purpose of a database is to host incredibly important data -- the lifeblood of an organization -- and make it accessible to processes and now agents, and if you don't do that securely, then you're going to have significant problems.

Has agentic AI changed the security requirements for a database, and if so, how?

Brandwine: I don't think that there are any new foundational problems due to agents. But organizations around the world have seen similar effects every time knowledge management -- information retrieval -- gets better. We've all always had search indices and internal document repositories, and every time the search engine improves, you discover that there are bunch of documents with the wrong permissions on them or that a set of people has access to information to information they shouldn't have had access to.

Large language models (LLMs) and agents are the best information retrieval technology that humanity has ever had, and so we are finding across the industry that there is a renewed focus on making sure that the agent has access to everything that it needs -- an agent that doesn't have access to appropriate information is an agent that's ineffective – but what it needs and no further. It's a problem that's been with us for as long as we've had databases.

Agentic AI exponentially increases the volume and sophistication of the attacks they can make on databases – is that something AWS has had to address?

Brandwine: We are seeing an increase in unwanted activity of certain kinds, and we believe it is attributable to agents. But fundamentally, agents are just a new technology. It is a thing that enables new things to happen, and they can be used by defenders as well as adversaries. At AWS, we have been making use of all the tools at our disposal, including agents, to better defend our customers.

Picking a cloud provider is a long-term relationship. You should pick a provider that has a proven track record that you have faith in and will evolve with you as the future unfolds and will provide protection no matter what the next big technology is. When we talk about this with customers, databases are absolutely an important part of the conversation, but they are part of the AWS picture as a whole.

The purpose of a database is to host incredibly important data -- the lifeblood of an organization -- and make it accessible to processes and now agents, and if you don't do that securely, then you're going to have significant problems.

What is that picture as a whole, as it relates to security and defending against unwanted activity?

Brandwine: We have AWS Private Cloud VPC with multiple layers of network protections and additional network telemetry, and we have our security services like Guard Duty where we do the monitoring for you to identify potentially unwanted activity. You have to look at the entire suite of services that a provider offers and evaluate that for your security needs.

What can be the costs of insufficient database security, and conversely, what are the benefits of appropriate database security?

Brandwine: The ideal security model is one where nothing you don't want ever happens, but everything that you do want happens seamlessly. That is the perfect model. We'll never exactly achieve that, but that is what we strive for. [In the ideal], you minimize your costs … and you maximize the amount of value that you can provide -- the innovation of your builders is supported and your business processes are running without impact.

The costs of poor database security are the exact opposite of this. In pretty much every application, data is the center of that application. It exists to manage, manipulate, query, and derive insight from. Almost always the core of that application is going to be some kind of database. One of the worst conversations you can have with your leadership is that you've had some kind of security issue and you can continue operating in an unknown state or you can take the application offline. Proactive investment and making sure you have the right mechanisms in place up front enable you to confidently ensure continued business operations.

You mentioned that security has been integral to AWS' database strategy from the outset, but has agentic AI forced AWS to make any changes over the past couple of years?

Brandwine: Agentic AI has impacted everyone's roadmap. We have features like vector search in DynamoDB and [vector storage] in S3, but the security story for our databases is on the same trajectory as it's always been on.

An agent fundamentally is just another actor in the system. It's something that can make API pulls, it's something that can issue queries, and from a security perspective, it doesn't matter what the source of those requests or queries is. We have to make sure that things the customer wants to enable are enabled, and that everything else is denied.

We've been speaking very broadly about database security, but getting down to some details, what are some of AWS' key database security features?

Brandwine: If you look at the suite of services that we offer, the different engines, customers want all of these different data management technologies and database engines. That can be open source engines like PostgreSQL and MariaDB, or proprietary engines like Oracle and Microsoft SQL Server. Customers want us to support these engines, and they want new releases very quickly after they become available.

That means we are constantly updating our database services. Databases themselves are not designed as security containers. The people that authored any of these databases -- Oracle, MySQL -- did not design them to hold an adversary inside the database, so we don't treat the database as a security container. We build multiple layers of security around that database.

Can you give an example of what that looks like in a real-world situation?

Brandwine: Last year at re:Invent, we shared that a couple of researchers from a company called Varonis managed to break out of their PostgreSQL instance. This is something that we strive to prevent, but we acknowledge is inevitable. … These researchers were able to break out of the database instance, but then our security measures kicked in, they were immediately detected, they were immediately stopped, and we were on the phone with them pretty quickly and asking what was going on.

That's not really a feature of the database. It's just an inherent property of it. It's not an API that customers turn on. It's a thing that's a part of every database service that we offer, and … not something you bolt on afterward.

What could have happened if AWS hadn't been so quick to detect the researchers – are there barriers in place that would have prevented them from going further beyond their PostgreSQL instance than they did?

Brandwine: I can speak for hours about how we have done identity management and privilege management within our database services, ensuring that if someone does manage to gain even more access than those Varonis researchers managed to gain, that there aren't any credentials that they could get that would give them cross-tenant access. There isn't any next hop that they could take that could give them broad access to our customers' data.

Since agents are designed to act autonomously, how is AWS empowering agents to act but limiting what they can access to ensure proper security?

Brandwine: It is incredibly important that agents have credentials, but our rule is that no agent should ever get a credential that wasn't explicitly issued to it. The challenge that we've had with agents, and we're seeing this broadly across the industry, is that they have goal-seeking behavior. The agent determines through a process that to make a change, it has to delete the production database. Clearly, deleting the production database is a bad thing. The agent will seek to get credentials that will delete the database. Making sure that the credentials that are issued to the agent are scoped to the activity that you've asked the agent to perform, and that the agent cannot get access to credentials, is incredibly important.

As AWS' database strategy evolves, what is generally the impetus for change -- does it come from customer feedback, or is something else often the main motivator?

Brandwine: We talk a lot about working backwards from customers. But Henry Ford has an interesting quote about this, which that if he'd listened to his customers, he would have built a faster horse. The point is that your customers … won't necessarily ask for the thing that we should build, so we have to innovate on their behalf. We have to talk to a whole bunch of customers and spot the pattern in what they're asking for, then come up with an idea that is not the next step forward, but is the thing that really answers the customers' needs.

With many organizations now putting agents into production, trying to lower the cost of AI development and deployment is becoming a trend. Is AWS doing things to help users keep their database spending under control?

Brandwine: We have a broad sweep of cost management features. In fact, [we introduced] a number of them at re:Invent last year.

Another thing that's applicable here is that in Bedrock, which is our model hosting service, we seek to provide customers with the broadest collection of models anywhere, and do so very promptly after a model is released. When a new model comes out, we do a few parameter changes to switch from one model to the new one so we can benchmark an application against the new model. What we find is that for any given application, there is not one right model. There are different workloads within an application. Some are complex and require advanced reasoning, and some just require parsing some human text and forming a response.

Being able to select different models and experiment rapidly to understand their strengths and weaknesses … has been a huge lever for us and our customers in managing the cost of their GenAI applications.

What do you think will be the next big problem that database security measures will have to protect against?

Brandwine: In the database security world, I don't know that there is a next big problem. In the agentic space, I think that the cost focus is increasing broadly across the industry.

As you plot AWS' database security strategy, what are some areas of focus?

Brandwine: We pride ourselves on giving our customers choice. That means that we minimally constrain our customers. They can go innovate, they can have ideas that we never even contemplated and innovate on behalf of their customers and do all sorts of clever things. It's incredibly important that we enable that innovation. But, as a security professional, what I care about are the results that our customers achieve. Making sure that the vast majority of our customers have a delightful day in the cloud is our goal. We're going to continue the path that we've been on for years of relentlessly measuring ourselves, understanding the results that our customers are achieving, and figuring out how we can make those results better.

Eric Avidon is a senior news writer for Informa TechTarget and a journalist with more than three decades of experience. He covers analytics and data management.